External Secrets: dockerconfigjson template renders "invalid character <"

TL;DR

For "Secret "docker-registry" is invalid: data[.dockerconfigjson]: Invalid value: "...":": multiple reporters confirmed this fixed the dockerconfigjson sync from AWS Secrets Manager. If a template arrives at the inner engine already mangled, the error will point at the inner engine but the cause is the outer one.

Secret "docker-registry" is invalid: data[.dockerconfigjson]: Invalid value: "...":
invalid character '<' looking for beginning of value

Steps

1. Escape the braces so the outer renderer passes them through untouched. In the

ExternalSecret template, write:

{{ "{{" }}.mysecret{{ "}}" }}

2. ArgoCD renders that back to {{ .mysecret }}, which is what the operator needs

to see. Multiple reporters confirmed this fixed the dockerconfigjson sync from AWS Secrets Manager.

3. Whenever you stack template engines (Helm -> ArgoCD -> external-secrets), ask who

renders first and escape for the outer one. If a template arrives at the inner engine already mangled, the error will point at the inner engine but the cause is the outer one.

When to use

You are seeing this: An ExternalSecret template syncing a docker registry secret from AWS Secrets Manager fails with: ` Secret "docker-registry" is invalid: data[.dockerconfigjson]: Invalid value: "...": invalid character '<' looking for beginning of value ` The deployment... Use this skill when you run into "External Secrets: dockerconfigjson template renders "invalid character <"".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

This is a double-templating collision.

A user asked why syncing a docker registry secret from AWS Secrets Manager into a Kubernetes dockerconfigjson secret via an ExternalSecret template failed with invalid character less-than. The verified resolution: it is a double-templating collision, ArgoCD and Helm consume the {{ }} in the ExternalSecret template before the external-secrets operator sees it, so escape the braces for the outer renderer (write {{ "{{" }}.mysecret{{ "}}" }} so ArgoCD renders it back to {{ .mysecret }}); multiple reporters confirmed this fixed the dockerconfigjson sync. Thread: https://vectle.com/threads/thr_aXWpnVTVOcwMYkYjyFgNkQ